by Kastro
Paper/Archive/CVE-2025-54948

CVE-2025-54948

Trend Micro, Inc. Trend Micro Apex One — Trend Micro Apex One OS Command Injection Vulnerability

KEV · due 8 SepEPSS 25%public exploitSSVC actCVSS 9.4
critical.is priorityof 100
98
CVSS 9.4 (CNA)9.4 / 10 × 3028.2In CISA KEV+3030.0EPSS percentile 97.9.979 × 2019.6Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.

Affected

ProductAffectedFixed inSource
Trend Micro Apex One2019 (14.0) – < 14.0.0.1403914.0.0.14039CNA

Scores by source

trendmicro (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refsuccess.trendmicro.com/en-US/solution/KA-0020652refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54948kevcisa.gov/known-exploited-vulnerabilities-catalog